Problem/Motivation

Follow-up for #3357247: Update guzzlehttp/psr7 dealing with https://github.com/advisories/GHSA-wxmh-65f7-jcvw

If I'm not mistaken only core-recommended constraints were updated and not core constraints.

Isn't the current policy still to also up core constraints (caret) for security updates? Meaning not just core-recommended constraints (tilde)?

Like for example when twig/twig was upped in core from ^2.15.0 to ^2.15.3 in 9.4.7. (https://git.drupalcode.org/project/drupal/-/commit/82a7d4dd3077ef16b69f2...)

I think there are more recent examples out there, but not able to give one right now.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#9 3357825-10.1.x-9.patch1.28 KBspokje
#9 3357825-10.0.x-9.patch1.27 KBspokje
#9 interdiff.3-9.10-1.x.txt421 bytesspokje
#9 interdiff.3-9.10-0.x.txt421 bytesspokje
#3 357825-10.0.x-3.patch955 byteseric_a
#3 3357825-10.1.x-3.patch966 byteseric_a

Issue fork drupal-3357825

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

Eric_A created an issue. See original summary.

eric_a’s picture

eric_a commented
Status: Fixed » Active
eric_a’s picture

eric_a commented
Status: Active » Needs review
Parent issue: #3357247: Update guzzlehttp/psr7 »
StatusFileSize
new 3357825-10.1.x-3.patch966 bytes
new 357825-10.0.x-3.patch955 bytes
eric_a’s picture

eric_a commented
Assigned: eric_a » Unassigned

Changing ^2.4 to ^2.4.5 for 10.0 and 10.1. It's not an issue for the other branches because guzzlehttp/psr7 is not a core root requirement there.

Status: Needs review » Needs work

The last submitted patch, 3: 357825-10.0.x-3.patch, failed testing. View results

spokje’s picture

spokje
Primary language Dutch
commented

Looks like the patches need a COMPOSER_ROOT_VERSION=10.0.x-dev composer update drupal/core and/or COMPOSER_ROOT_VERSION=10.1.x-dev composer update drupal/core to update the root composer.lock hash.

elber made their first commit to this issue’s fork.

elber opened merge request !3912

spokje’s picture

spokje
Primary language Dutch
commented
StatusFileSize
new interdiff.3-9.10-0.x.txt421 bytes
new interdiff.3-9.10-1.x.txt421 bytes
new 3357825-10.0.x-9.patch1.27 KB
new 3357825-10.1.x-9.patch1.28 KB
spokje’s picture

spokje
Primary language Dutch
commented
Status: Needs work » Needs review
smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community
Issue tags: +Needs Review Queue Initiative

Don't mind marking this for ya.

catch’s picture

catch
he/him
Primary language English
commented
Version: 10.0.x-dev » 9.5.x-dev
Status: Reviewed & tested by the community » Needs work

This makes sense - should we also do it in 9.5.x? Moving back for that.

  • catch committed 4db64697 on 10.0.x 
    Issue #3357825 by Spokje, Eric_A: Update guzzlehttp/psr7 constraint

  • catch committed f5baa0d8 on 10.1.x 
    Issue #3357825 by Spokje, Eric_A: Update guzzlehttp/psr7 constraint
longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Version: 9.5.x-dev » 10.0.x-dev
Status: Needs work » Fixed

We only have an indirect dependency in 9.5.x so there is nothing to update there; we used Diactoros to implement PSR7 in Drupal 9 and switched to Guzzle in Drupal 10, so we added a direct dependency at that point.

catch’s picture

catch
he/him
Primary language English
commented

Ahh good point.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.